Hardware-based packet editor

ABSTRACT

Hardware-based packet editor receives a packet editing script which includes script entries indicating modifications to a data packet and a data block with data for the modified data packet. For a script entry in the packet editing script, the packet editor copies data in the data block at a block location and with a block length identified in the script entry into a packet buffer. The packet editor repeats the copying for the remaining script entries for the modified data packet. The packet editor then generates the modified data packet with the data in the packet buffer. The packet editing script is generated such that a script entry is created for data to be included in the modified data packet and data to be inserted into the modified data packet. Creation of a script entry is omitted for data to be removed.

BACKGROUND OF THE INVENTION

1. Field

This invention relates generally to data communications, and morespecifically, to a service gateway.

2. Background

Service gateways such as firewall, server load balancers have beendeployed by service providers and enterprises. In the past, servicegateways were used for special purposes such as security. They are,however, used in expanded ways today. Many service providers deployservice gateways to perform various service gateway applications toexamine and analyze data packets of a communication session between ahost device and a server computer. Many gateway applications modify thepackets to assist the analysis of the data packets and the communicationsessions. Packet modification is a computation intensive and memoryaccess intensive task. The modification task is usually performed by aprocessor module of a service gateway. Typically the processor orprocessor module analyzes a data packet, determines the necessarymodification data blocks, creates a packet memory buffer, copies somedata from the data packet into the data packet memory buffer and copiesthe modification data blocks into the packet memory buffer. When thedata copying is completed, the processor has generated a new data packetfrom the original data packet. The service gateway then sends thegenerated data packet onto the network.

The data packet modification process is costly to the processor module,consuming CPU cycles and memory access bandwidth. If the data packetmodification process can be offloaded and handled by a high performinghardware-based module of service gateway, the processor module canallocate its resources to handle additional data packets or additionalcommunication sessions.

Therefore, there is a need to introduce a hardware-based high performingpacket editing module to handle the data packet modification.

BRIEF SUMMARY OF THE INVENTION

According to one embodiment of the present invention, a method formodifying a data packet by a hardware-based packet editor, comprises:(a) receiving, by the packet editor, a packet editing script comprisingone or more script entries indicating modifications to be applied to thedata packet and a data block comprising data for the modified packet;(b) for each given script entry in the packet editing script, copying,by the packet editor, data in the data block at a location and a sizeidentified in the given script entry into a packet buffer; and (c)generating, by the packet editor, a modified data packet with the datain the packet buffer.

In one aspect of the present invention, the copying (b) comprises: (b1)retrieving the given script entry of the packet editing script; (b2)determining whether the given script entry is a first script entry forthe modified data packet; (b3) in response to determining that the givenscript entry is the first script entry for the modified data packet,reserving the packet buffer for the modified data packet; (b4) copyingthe data in the data block at a block location and with a block lengthidentified in the given editing script into the packet buffer; (b5)determining whether the given script entry is a last script entry forthe modified data packet; (b6) in response to determining that the givenscript entry is not the last script entry for the modified data packet,performing the copying (b4) and the determining (b5) for the next givenscript entry of the packet editing script.

In one aspect of the present invention, the determining (b2) comprises:(b2i) determining whether a start of packet (SOP) indicator in the givenscript entry indicates that the given script entry is the first scriptentry for the modified data packet.

In one aspect of the present invention, the determining (b5) comprises:(b5i) determining whether an end of packet (EOP) indicator in the givenscript entry indicates that the given script entry is the last scriptentry for the modified data packet.

In one aspect of the present invention, the reserving (b3) and thecopying (b4) comprises: (b3i) setting a packet buffer marker at abeginning of the packet buffer; (b4i) appending a copy of the data inthe data block at the block location and with the block lengthidentified in the given editing script to the packet buffer at thepacket buffer marker; and (b4ii) modifying the packet buffer marker bythe block length identified in the given editing script.

In one aspect of the present invention, the generating (c) comprises:(c1) in response to determining that the given script entry is the lastscript entry for the modified data packet, generating the modified datapacket with the data in the packet buffer.

In one aspect of the present invention, the generating (c) furthercomprises: (c2) determining whether the given script entry is the lastscript entry in the packet editing script; and (c3) in response todetermining that the given script entry is not the last script entry inthe packet editing script, repeating the retrieving (b1), thedetermining (b2), the reserving (b3), the copying (b4), the determining(b5), the performing (b6), and the generating (c1) for a next givenscript entry in the packet editing script.

In one aspect of the present invention, the determining (c2) comprises:(c2i) determining whether an end of table (EOT) indicator in the givenscript entry indicates that the given script entry is the last scriptentry in the packet editing script.

According to another embodiment of the present invention, a method forprocessing a data packet by a service gateway comprising a processor,comprises: receiving, by the processor, a data packet from a host to besent to a server, or from the server to be sent to the host;determining, by the processor, that the data packet requiresmodification prior to sending to the server or the host; generating, bythe processor, a packet editing script, the script comprising one ormore script entries indicating modifications to be applied to the datapacket and a data block comprising data for the modified packet, whereinthe generating comprises: for each and any given portion of the datapacket determined to be included in the modified packet, generating afirst script entry identifying a first location and a first length inthe data block corresponding to the given portion determined to beincluded; for each and any given portion of the data packet determinedto be removed from the data packet, omitting generation of a scriptentry corresponding to the given portion determined to be removed; andfor each and any new data determined to be added to the modified packet,generating the new data to be comprised in the data block of the packetediting script and generating a second script entry identifying a secondlocation and a second length in the data block corresponding to the newdata; and sending, by the processor, the packet editing script to ahardware-based packet editor, wherein the packet editor generates themodified packet according to the script entries in the packet editingscript.

System and computer program products corresponding to theabove-summarized methods are also described and claimed herein.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE FIGURES

FIG. 1 illustrates an embodiment of a communication session processingmethod using a service gateway having a hardware-based packet editoraccording to the present invention.

FIG. 2 illustrates an embodiment of a packet processing flow accordingto the present invention.

FIG. 3 illustrates an embodiment of a packet editing script according tothe present invention.

FIGS. 4 and 4 a illustrate an embodiment of a packet editor processingflow according to the present invention.

FIG. 5 illustrates an example of a removal of a HTTP header attributeaccording to an embodiment of the present invention.

FIG. 6 illustrates an example of an insertion of a HTTP header and afragmentation of a packet into two packets according to an embodiment ofthe present invention.

FIG. 7 illustrates additional embodiments of a service gatewayapplication according to the present invention.

DETAILED DESCRIPTION OF THE INVENTION

The following description is presented to enable one of ordinary skillin the art to make and use the present invention and is provided in thecontext of a patent application and its requirements. Variousmodifications to the embodiment will be readily apparent to thoseskilled in the art and the generic principles herein may be applied toother embodiments. Thus, the present invention is not intended to belimited to the embodiment shown but is to be accorded the widest scopeconsistent with the principles and features described herein.

The present invention can take the form of an entirely hardwareembodiment, an entirely software embodiment or an embodiment containingboth hardware and software elements. In a preferred embodiment, thepresent invention is implemented in software, which includes but is notlimited to firmware, resident software, microcode, etc.

Furthermore, the present invention can take the form of a computerprogram product accessible from a computer-usable or computer-readablemedium providing program code for use by or in connection with acomputer or any instruction execution system. For the purposes of thisdescription, a computer-usable or computer readable medium can be anyapparatus that can contain, store, communicate, propagate, or transporteh program for use by or in connection with the instruction executionsystem, apparatus, or device.

The medium can be an electronic, magnetic, optical, electromagnetic,infrared, or semiconductor system (or apparatus or device) or apropagation medium. Examples of a computer-readable medium include asemiconductor or solid state memory, magnetic tape, a removable computerdiskette, a random access memory (RAM), a read-only memory (ROM), arigid magnetic disk and an optical disk. Current examples of opticaldisks include compact disk-read only memory (CD-ROM), compactdisk-read/write (CD-R/W) and DVD.

A data processing system suitable for storing and/or executing programcode will include at least one processor coupled directly or indirectlyto memory elements through a system bus. The memory elements can includelocal memory employed during actual execution of the program code, bulkstorage, and cache memories which provide temporary storage of at leastsome program code in order to reduce the number of times code must beretrieved from bulk storage during execution.

Input/output or I/O devices (including but not limited to keyboards,displays, point devices, etc.) can be coupled to the system eitherdirectly or through intervening I/O controllers.

Network adapters may also be coupled to the system to enable the dataprocessing system to become coupled to other data processing systems orremote printers or storage devices through intervening private or publicnetworks. Modems, cable modem and Ethernet cards are just a few of thecurrently available types of network adapters.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof code, which comprises one or more executable instructions forimplementing the specified local function(s). It should also be notedthat, in some alternative implementations, the functions noted in theblock may occur out of the order noted in the figures. For example, twoblocks shown in succession may, in fact, be executed substantiallyconcurrently, or the blocks may sometimes be executed in the reverseorder, depending upon the functionality involved. It will also be notedthat each block of the block diagrams and/or flowchart illustration, andcombinations of blocks in the block diagrams and/or flowchartillustration, can be implemented by special purpose hardware-basedsystems that perform the specified functions or acts, or combinations ofspecial purpose hardware and computer instructions.

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting of the invention. Asused herein, the singular forms “a”, “an” and “the” are intended toinclude the plural forms as well, unless the context clearly indicatesotherwise. It will be further understood that the terms “comprises”and/or “comprising,” when used in this specification, specify thepresence of stated features, integers, steps, operations, elements,and/or components, but do not preclude the presence or addition of oneor more other features, integers, steps, operations, elements,components, and/or groups thereof.

In an embodiment illustrated in FIG. 1, a service gateway 300 processesa communication session 400 between a host 100 and a server 200. Session400 is delivered over a data network 150.

In one embodiment, data network 150 includes an Internet Protocol (IP)network, a corporate data network, a regional corporate data network, anInternet service provider network, a residential data network, a wirednetwork such as Ethernet, a wireless network such as a WiFi network, aBluetooth network, or a cellular network. In one embodiment, datanetwork 150 resides in a data center, or connects to a network orapplication network cloud.

Host 100 is a computing device with network access capabilities. In oneembodiment, host 100 is a workstation, a desktop personal computer or alaptop personal computer, a Personal Data Assistant (PDA), a tablet PC,a smartphone, or a cellular phone, a set-top box, an Internet mediaviewer, an Internet media player, a smart sensor, a smart medicaldevice, a net-top box, a networked television set, a networked DVR, anetworked Blu-ray player, a media center, or a network connected device.

Server 200 is a computing device typically coupled to a processor and acomputer readable medium which stores computer readable program code.Server 200, with the processor and the computer readable program code,implements functionality of a Web server, a file server, a video server,a database server, an application server, a voice system, a conferencingserver, a media gateway, a media center, an app server or a networkserver providing a network service or an application service to host 100using the communication session 400.

Service gateway 300 is operationally coupled to a processor module 310,a packet editor 350, a network interface module 330, and a computerreadable medium 340. The computer readable medium 340 stores computerreadable program code, which when executed by the processor module 310,implements the various embodiments of the present invention as describedherein. In some embodiments, service gateway 300 is implemented as aserver load balancer, an application delivery controller, a servicedelivery platform, a traffic manager, a security gateway, a component ofa firewall system, a component of a virtual private network (VPN), aload balancer for video servers, a gateway to distribute load to one ormore servers, a Web or HTTP server handling the HTTP layer of the HTTPservice session 300, or a gateway performing network address translation(NAT).

Processor module 330 typically includes one or more general processorsor micro-processors. In one embodiment, processor module 330 includes amulti-core microprocessor. In one embodiment, processor module 330includes a memory unit storing variables used during execution of thecomputer readable program code stored in computer readable module 340.

Network interface module 330 connects to data network 150. Networkinterface module 330 receives data packets of communication session 400from host 100 and server 200, and sends data packets of communicationsession 400 to host 100 and server 200.

Packet editor 350 is a hardware-based packet processing acceleratingmodule, typically comprising high performing capabilities to processdata packets. In one embodiment, packet editor 350 includes a fieldprogrammable gate array (FPGA) module, an application specificintegrated circuit (ASIC), a digital signal processor (DSP), or acircuitry capable of performing the high speed processing needs ofpacket editor 350.

In one embodiment, host 100 sends a data packet 403 of communicationsession 400 towards server 200. Service gateway 300 receives data packet403 through network module 330. Processor module 310 processes datapacket 403 according to the computer readable program code stored on thecomputer readable medium 340. Processor module 310 determines that datapacket 403 is to be modified by packet editor 350. Packet editor 350receives data packet 403 and generates data packet 408. Network module330 transmits data packet 408 to server 200.

In one embodiment, server 200 sends a data packet 418 of communicationsession 400 towards host 100. Service gateway 300 receives data packet418 through network module 330. Processor module 310 processes datapacket 418 according to the computer readable program code stored on thecomputer readable medium 340. Processor module 310 determines that datapacket 418 to be modified by packet editor 350. Packet editor 350receives data packet 418 and generates data packet 413. Network module330 transmits data packet 408 to server 200.

In one embodiment, data packet 403 is a HyperText Transport Protocol(HTTP) packet, and packet editor 350 removes a part of HTTP header ofdata packet 403 to generate data packet 408. In one embodiment, 418 is aHTTP packet and packet editor 350 inserts a HTTP header to data packet418 in order to generate data packet 413.

In one embodiment, data packet 403 is an IP packet comprising an IPheader, and packet editor 350 inserts a second IP header to data packet403 in order to generate an IP tunnel data packet 413. In oneembodiment, packet editor 350 performs IP fragmentation to generate datapacket 413 and a second data packet (not shown) prior to sending datapacket 413 and the second data packet to server 200. In one embodiment,data packet 418 is an IP tunnel packet and packet editor 350 removes anIP header from data packet 418 in order to generate data packet 413.

In one embodiment, packet editor 350 processes data packet 403 togenerate data packet 408 by copying one or more data blocks of datapacket 403 onto data packet 408, copying additional data blocks ontodata packet 408 through instruction from processor module 310, computinga checksum using one or more parts of data packet 403, and placing thechecksum onto data packet 408.

The above mentioned data packet modification of data packet 408 areapplicable in many implementations of service gateway 300, for example,as a HTTP proxy server, TCP proxy server, Layer 3/Layer 4 tunnelgateway, a firewall, IP tunnel gateway, IPv4/IPv6 tunneling gateway,IP-IP tunneling gateway.

FIG. 2 illustrates service gateway 300 processing a data packet 405.Service gateway 300 receives a data packet 405. Data packet 405 may besent by host 100 or server 200. Service gateway 300 implements a servicegateway application 314, which is a software residing in computerreadable medium 340 executed by processor module 310. Application 314determines, based on data packet 405, that data packet 405 requiresmodification. Application 314 generates a packet editing script 512.Packet editing script 512 includes one or more script entries thatindicate the necessary modification(s) to be applied to data packet 405.When the application 314 determines that data is to be included in thedata packet 305, the application 314 generates a script entry describingthe data to be included. When the application 314 determines that datais to be removed from the data packet 305, the application 314 omitsgenerating a script entry that would describe the data being removed.When the application 314 determines that data is to be inserted into thedata packet 305, the application 314 generates a script entry describingthe data to be inserted. A more detailed description of the packetediting script 512 follows later in this specification.

For example, in one embodiment, application 314 determines that a HTTPheader is to be removed from data packet 305. Packet editing script 512describes the part of HTTP header to be removed. In one embodiment,application 314 determines that a HTTP header is to be inserted intodata packet 305. Packet editing script 512 describes the location wherethe HTTP header is to be inserted and the data for the HTTP header. Inone embodiment, application 314 determines that an additional IP headeris to be inserted into data packet 305. Packet editing script 512describes the details of the additional IP header such that packeteditor 350 will perform the insertion. In one embodiment, packet editingscript 512 includes data packet 405. Application 314 then sends thepacket editing script 512 to the packet editor 350, effectivelyinforming the packet editor 350 that it is to modify data packet 305using packet editing script 512.

Packet editor 350 receives packet editing script 512 and generates datapacket 415 based on the packet editing script 512.

In one embodiment, packet editor 350 sends data packet 415 to networkmodule 330 for transmission. In one embodiment, packet editor 350informs application 314 after generation of data packet 415. Application314 informs network module 330 to transmit data packet 415.

FIG. 3 illustrates a packet editing script 512. In one embodiment,packet editing script 512 includes a script entry table 524 and a datablock 527.

Script entry table 524 includes a script entry 542. In one embodiment,script entry 542 includes a plurality of field comprising a blocklocation 551, a block length 552, a start-of-packet indication (SOP)554, an end-of-packet indication (EOP) 553, and an end-of-scriptindication (EOT) 555. In one embodiment, SOP 554, EOP 553 and EOT 555are 1-bit long indicators; block location 551 has a 10-bit value; blocklength 552 has an 11-bit value. Script entry 542 may include one or moreunused multi-bit fields such that script entry 542 is a 4-byte or 32-bitlong data structure.

Block location 551 and block length 552 references a block of data indata block 527. Block location 551 refers to the location of data block527.

In one embodiment, script entry table 524 includes a second script entry543. with the same fields The one or more script entries, such as scriptentry 542 and script entry 543, are used by packet editor 350 togenerate a modified data packet.

Data block 527 contains one or more blocks of data to generate amodified data packet.

FIG. 4 illustrates packet editor 350 generating a data packet 353 basedon packet editing script 512. In this embodiment, packet editor 350includes a control memory 354, a control module 356, a packet buffer359, and a packet buffer marker 358.

FIG. 4 a illustrates, in conjunction with FIG. 4, a processing flow ofpacket editor 350. In step 931, in response to receiving the packetediting script 512, packet editor 350 retrieves one or more scriptentries from script entry table 524 and stores the script entries intocontrol memory 354. In one embodiment packet editor 350 retrieves scriptentry 542 from script entry table 524 and stores script entry 542 intocontrol memory 354. Packet editor 350 examines EOT 555 of script entry542. In one embodiment, EOT 555 has a value of 0. Packet editor 350determines script entry 542 is not the last script entry of script entrytable 524. Packet editor 350 retrieves a next script entry from scriptentry table 524. In one embodiment, EOT 555 has a value of 1. Packeteditor 350 determines script entry 542 is the last script entry ofscript entry table 524. Packet editor 350 completes step 951.

In step 933, control module 356 retrieves script entry 542 from controlmemory 354, and starts to process script entry 542.

In step 935, control module 356 examines SOP 554. In one embodiment, SOP554 has a value of 1. Control module 356 reserves packet buffer 359 inorder to generate a data packet 353. Control module 356 sets the valueof packet buffer marker 358 at 0, or at the beginning of packet buffer359. In one embodiment, SOP 554 has a value of 0. Control module 356proceeds to another step.

In step 937, control module 356 copies a block of data from data block527 to packet buffer 359, based on block location 551 and block length552 of script entry 542. Control module 356 appends to packet buffer 359at the packet buffer marker 358 the block of data from data 527 startingfrom block location 551 with a size of block length 552. Control module356 increases packet buffer marker 358 by the value of block length 552,such that the subsequent copy would start after the current copied datablock.

In step 939, control module 356 examines EOP 553. In one embodiment, EOP553 has a value of 1. Control module 356 determines the completion ofgenerating data packet 353 in packet buffer 359, with a block of data upto the packet buffer marker 358. Packet editor 350 continues with step943. In one embodiment, EOP 553 has a value of 0, step 943 is skipped,and control module 356 proceeds to step 949.

In step 943, packet editor 350 further includes a checksum module 357.Checksum module 357 computes a checksum for data packet 353. In oneembodiment, data packet 353 includes an IP packet. Checksum module 357computes a checksum for the IP header and modifies data packet 353 withthe computed checksum. In one embodiment, data packet 353 includes a TCPor UDP packet, checksum module 357 computes a checksum for thecorresponding TCP or UDP packet, and modifies data packet 353 with thecomputed checksum. In one embodiment, data packet 353 includes a packetformat requiring a checksum, checksum module 357 computes a checksum forthe packet format and modifies data packet 353 with the computedchecksum.

In step 949, control module 356 examines EOT 555. In one embodiment, EOT555 has a value of 1. Control module 356 determines processing of packetediting script 512 is completed. In one embodiment, EOT 555 has a valueof 0, control module 356 fetches a second script entry from controlmemory 354 and repeats performing steps 933-949 for the second scriptentry.

FIG. 5 illustrates an example packet editing script 612 to remove a HTTPheader field. In this embodiment, script entry table 624 includes scriptentry 642 and script entry 643. Script entry 642 includes

Block location 651=8

Block length 652=192

SOP 654=1

EOP 653=0

EOT 655=0

Script entry 643 includes

Block location 661=284

Block length 662=726

SOP 664=0

EOP 663=1

EOT 665=1

Data block 627 includes a total of 1000 bytes of data, which may be aHTTP packet.

Packet editor 350 constructs a data packet 409 according to packetediting script 612, as illustrated in FIG. 4. More specifically, packeteditor 350 obtains script entry 642 of script entry table 624. Scriptentry 642 indicates in EOT 655 (of value 0) that script entry 642 is notthe last script entry in script entry table 624. SOP 654 of value 1indicates a beginning of a data packet. Packet editor 350 prepares apacket buffer for data packet 409. Packet editor 350 examines blocklocation 651 and block length 652. Packet editor 350 copies a total of192 (value of block length 652) bytes of data block 627, starting atlocation 8 (value of block location 651).

EOP 653 of value 0 indicates generation of data packet 409 is notcompleted. After completion of script entry 642, packet editor 350obtains script entry 643 and processes accordingly. SOP 664 has a valueof 0, indicating to packet editor 350 to continue with data packet 409.Packet editor 350 examines block location 661 and block length 662.Packet editor 350 copies 726 (value of block length 662) bytes of data627 starting at location 284 (value of block location 661) of packetediting script 612. Upon completion of copying, packet editor 350determines from the value (1) of EOP 663 that data packet 409 generationis completed.

EOT 665 of value 1 indicates that script entry 643 is the last entry inscript entry table 624. Packet editor 350 determines the completion ofprocessing of packet editing script 612.

In this embodiment, packet editor 350 does not copy data block fromlocation 192 to location 284 (for a total of 92 bytes). In oneembodiment, the data block not copied represents a HTTP header field tobe removed.

FIG. 6 illustrates an example a packet editing script 712 to insert ofdata, such as a HTTP header field, and to generate two data packets. Inone embodiment, generation of two packets indicates fragmenting an IPpacket into two IP packets. In this example, packet editing script 712includes script entry table 724, which includes script entries 742, 743,744, 745, and 746.

Script entry 742 includes

Block location 821=0

Block length 822=231

SOP 824=1

EOP 823=0

EOT 825=0

Script entry 743 includes

Block location 831=1544

Block length 832=200

SOP 834=0

EOP 833=0

EOT 835=0

Script entry 744 includes

Block location 841=251

Block length 842=1073

SOP 844=0

EOP 843=1

EOT 845=0

Script entry 745 includes

Block location 851=1524

Block length 852=20

SOP 854=1

EOP 853=0

EOT 855=0

Script entry 746 includes

Block location 861=1324

Block length 862=200

SOP 864=0

EOP 863=1

EOT 865=1

Data block 727 includes an original packet 772, a second packet header773, and a to-be-inserted data block 774. In this example, originalpacket 772 has a size of 1504 bytes; second packet header 773 is of size20 bytes and to-be-inserted data block 774 is of size 200 bytes.

The block location of original packet 772 is 20 in data block 727. Theblock location of the second packet header 773 is 1524. The blocklocation of the to-be-inserted data block 774 is 1324.

According to the process illustrated in FIG. 4, packet editor 350processes in the order of script entries 742, 743, 744, 745 and 746, andgenerates data packet 411 and data packet 412. In processing scriptentry 742 with SOP 824 being 1, packet editor 350 prepares data bufferfor data packet 411. Packet editor 350 copies a block of data from datablock 727 of size 231 bytes (value of block length 822) from location 20(value of block location 821). The block of data copied is the first 231bytes of original packet 772. Next, packet editor 350, according toscript entry 743, copies a block of data from data block 727 of size 200(value of block length 832) from location 1544 (value of block location831) onto data packet 411. The block of data copied includes theentirety of the to-be-inserted data block 774.

Then packet editor 350, according to script entry 744, copies a block ofdata from data block 727 of size 1073 (value of block length 842) fromlocation 251 (value of block location 841) onto data packet 411. Theblock of data copied is a data block in original packet 772 immediatelyfollowing the block of data copied in script entry 742. EOP 843 being 1indicates completion of data packet 411 generation.

Then packet editor 350 proceeds to process script entry 745. SOP 854being 1 instructs packet editor 350 to prepare to generate data packet412. Packet editor 350 copies a block of data from data block 727 ofsize 20 bytes (value of block length 852) from location 1524 (value ofblock location 851) onto data packet 412. The block of data copiedincludes the entirety of the second packet header 773.

Packet editor 350 proceeds to process script entry 746. Packet editor350 copies a block of data from data block 727 of size 200 bytes (valueof block length 862) from location 1324 (value of block location 861)onto data packet 412. The block of data copied is the remaining data ofthe original packet 772, after the block of data copied in script entry744.

EOP 863 of script entry 746 has a value 1. Packet editor 350 determinesdata packet 412 generation is completed. EOT 865 of script entry 746 hasa value 1. Packet editor 350 determines processing of packet editingscript 712 is completed. As a result of completing packet editing script712, packet editor 350 generates data packet 411 and data packet 412.

The above figures illustrate embodiments of packet editing script 512 toremove or not to copy one or more blocks of data from data block 527 andto copy one or more blocks of data from data block 527. By using thecopying instructions, those skilled in the art may formulate a packetediting script for various data packet manipulation.

In one embodiment, service gateway application 314, illustrated in FIG.7, implements a network address translation of an input data packet 405.Service gateway application 314 prepares a data block 532 as areplacement IP/TCP/UDP header for data packet 405. Service gatewayapplication 314 creates a packet editing script 512 wherein the datablock 527 includes data packet 405 and data block 532, and script entrytable 524 to include one or more script entries to instruct packeteditor 350 not to copy the IP/TCP/UDP header of data packet 405, copydata block 532, and copy the remaining portion of data packet 405.

In one embodiment of the present invention, service gateway application314 implements an IP tunneling gateway (such as IP-IP tunnel, IPv4/IPv6tunnel). Service gateway application 314 receives data packet 405 anddetermines that an IP tunnel header is to be inserted. Service gatewayapplication 314 prepares data block 532 as the IP tunnel header. Servicegateway application 314 creates a packet editing script 512, where thedata block 527 includes data packet 405 and data block 532, and scriptentry table 524 to include one or more script entries to instruct packeteditor 350 to copy data block 532, and to copy data packet 405.

In one embodiment, service gateway application 314 determines an IPtunnel header is to be removed. Service gateway application 314determines the size of the IP tunnel header. Service gateway application314 creates a packet editing script 512, where the data block 527includes data packet 405, and a script entry 542 such that the blocklocation of script entry 542 skips the tunnel header. Packet editingscript 512 instructs packet editor 350 to copy data packet 405 whileskipping, or not copying, the IP tunnel header.

In one embodiment, service gateway application 314 implements a proxyservice such as TCP proxy or HTTP proxy. Service gateway application 314receives an input data packet 405 and determines that a first pluralityof data blocks in data packet 403 is to be replaced by a secondplurality of data blocks. Service gateway application 314 prepares thesecond plurality of data blocks, and creates a packet editing script512, where the data block 527 of packet editing script 512 includes datapacket 405 and the second plurality of data blocks. The packet editingscript 512 also prepares script entry table 524 to include a pluralityof script entries instructing packet editor 350 to copy certain datablocks from data packet 405, not to copy the first plurality of datablocks from data packet 405, and to copy the second plurality of datablocks, in essence replacing the first plurality of data blocks with thesecond plurality of data blocks.

Although the present invention has been described in accordance with theembodiments shown, one of ordinary skill in the art will readilyrecognize that there could be variations to the embodiments and thosevariations would be within the spirit and scope of the presentinvention. Accordingly, many modifications may be made by one ofordinary skill in the art without departing from the spirit and scope ofthe appended claims.

What is claimed is:
 1. A method for modifying a data packet by ahardware-based packet editor, comprising: (a) receiving, by the packeteditor, a packet editing script comprising one or more script entriesindicating modifications to be applied to the data packet and a datablock comprising data for the modified packet; (b) for each given scriptentry in the packet editing script, copying, by the packet editor, datain the data block at a location and a size identified in the givenscript entry into a packet buffer; and (c) generating, by the packeteditor, a modified data packet with the data in the packet buffer. 2.The method of claim 1, wherein the copying (b) comprises: (b1)retrieving the given script entry of the packet editing script; (b2)determining whether the given script entry is a first script entry forthe modified data packet; (b3) in response to determining that the givenscript entry is the first script entry for the modified data packet,reserving the packet buffer for the modified data packet; (b4) copyingthe data in the data block at a block location and with a block lengthidentified in the given script entry into the packet buffer; (b5)determining whether the given script entry is a last script entry forthe modified data packet; (b6) in response to determining that the givenscript entry is not the last script entry for the modified data packet,performing the copying (b4) and the determining (b5) for the next givenscript entry of the packet editing script.
 3. The method of claim 2,wherein the determining (b2) comprises: (b2i) determining whether astart of packet (SOP) indicator in the given script entry indicates thatthe given script entry is the first script entry for the modified datapacket.
 4. The method of claim 2, wherein the determining (b5)comprises: (b5i) determining whether an end of packet (EOP) indicator inthe given script entry indicates that the given script entry is the lastscript entry for the modified data packet.
 5. The method of claim 2,wherein the reserving (b3) and the copying (b4) comprises: (b3i) settinga packet buffer marker at a beginning of the packet buffer; (b4i)appending a copy of the data in the data block at the block location andwith the block length identified in the given editing script to thepacket buffer at the packet buffer marker; and (b4ii) modifying thepacket buffer marker by the block length identified in the given editingscript.
 6. The method of claim 2, wherein the generating (c) comprises:(c1) in response to determining that the given script entry is the lastscript entry for the modified data packet, generating the modified datapacket with the data in the packet buffer.
 7. The method of claim 6,wherein the generating (c) further comprises: (c2) determining whetherthe given script entry is the last script entry in the packet editingscript; and (c3) in response to determining that the given script entryis not the last script entry in the packet editing script, repeating theretrieving (b1), the determining (b2), the reserving (b3), the copying(b4), the determining (b5), the performing (b6), and the generating (c1)for a next given script entry in the packet editing script.
 8. Themethod of claim 7, wherein the determining (c2) comprises: (c2i)determining whether an end of table (EOT) indicator in the given scriptentry indicates that the given script entry is the last script entry inthe packet editing script.
 9. A system, comprising: a packet buffer; anda hardware-based packet editor comprising a control memory and a controlmodule, wherein the packet editor: (a) receives a packet editing scriptcomprising one or more script entries indicating modifications to beapplied to the data packet and a data block comprising data for themodified packet, and (b) stores the packet editing script in the controlmemory, wherein the control module: (c) retrieves each given scriptentry stored in the control memory, (d) copies data in the data block ata location and a size identified in the given script entry into thepacket buffer, and (e) generates a modified data packet with the data inthe packet buffer.
 10. The system of claim 9, wherein in copying (d) thedata in the data block at the location and the size identified in thegiven script entry into the packet buffer, the control module: (d1)determines whether the given script entry is a first script entry forthe modified data packet; (d2) in response to determining that the givenscript entry is the first script entry for the modified data packet,reserves the packet buffer for the modified data packet; (d3) copies thedata in the data block at a block location and with a block lengthidentified in the given script entry into the packet buffer; (d4)determines whether the given script entry is a last script entry for themodified data packet; (d5) in response to determining that the givenscript entry is not the last script entry for the modified data packet,performs, for the next given script entry of the packet editing script,the copying of the data in the data block at the block location and withthe block length identified in the given script entry into the packetbuffer and the determining whether the given script entry is a lastscript entry for the modified data packet for the next given scriptentry of the packet editing script.
 11. The system of claim 10, whereinin determining (d1) whether the given script entry is the first scriptentry for the modified data packet, the control module: (d1i) determineswhether a start of packet (SOP) indicator in the given script entryindicates that the given script entry is the first script entry for themodified data packet.
 12. The system of claim 10, wherein in determining(d4) whether the given script entry is the last script entry for themodified data packet, the control module: (d4i) determines whether anend of packet (EOP) indicator in the given script entry indicates thatthe given script entry is the last script entry for the modified datapacket.
 13. The system of claim 10, wherein in reserving (d2) the packetbuffer for the modified data packet and in copying (d3) the data in thedata block at the block location and with the block length identified inthe given script entry into the packet buffer, the control module: (d2i)sets a packet buffer marker at a beginning of the packet buffer; (d3i)appends a copy of the data in the data block at the block location andwith the block length identified in the given editing script to thepacket buffer at the packet buffer marker; and (d3ii) modifies thepacket buffer marker by the block length identified in the given editingscript.
 14. The system of claim 10, wherein in generating (e) themodified data packet with the data in the packet buffer, the controlmodule: (e1) in response to determining that the given script entry isthe last script entry for the modified data packet, generates themodified data packet with the data in the packet buffer.
 15. The systemof claim 14, wherein in generating (e) the modified data packet with thedata in the packet buffer, the control module further: (e2) determineswhether the given script entry is the last script entry in the packetediting script; and (e3) in response to determining that the givenscript entry is not the last script entry in the packet editing script,repeating the retrieving (c), the determining (d1), the reserving (d2),the copying (d3), the determining (d4), the performing (d5), and thegenerating (e1) for a next given script entry in the packet editingscript.
 16. The system of claim 15, wherein in determining (e2) whetherthe given script entry is the last script entry in the packet editingscript, the control module: (e2i) determines whether an end of table(EOT) indicator in the given script entry indicates that the givenscript entry is the last script entry in the packet editing script. 17.A computer program product for modifying a data packet, the computerprogram product comprising: a computer readable memory device havingcomputer readable program code embodied therewith, the computer readableprogram code configured to: (a) receive a packet editing scriptcomprising one or more script entries indicating modifications to beapplied to the data packet and a data block comprising data for themodified packet; (b) for each given script entry in the packet editingscript, copy data in the data block at a location and a size identifiedin the given script entry into a packet buffer; and (c) generate amodified data packet with the data in the packet buffer.
 18. Thecomputer program product of claim 17, wherein the copy (b) is configuredto: (b1) retrieve the given script entry of the packet editing script;(b2) determine whether the given script entry is a first script entryfor the modified data packet; (b3) in response to determining that thegiven script entry is the first script entry for the modified datapacket, reserve the packet buffer for the modified data packet; (b4)copy the data in the data block at a block location and with a blocklength identified in the given editing script into the packet buffer;(b5) determine whether the given script entry is a last script entry forthe modified data packet; (b6) in response to determining that the givenscript entry is not the last script entry for the modified data packet,perform the copy (b4) and the determine (b5) for the next given scriptentry of the packet editing script.
 19. The computer program product ofclaim 18, wherein the determine (b2) is configured to: (b2i) determinewhether a start of packet (SOP) indicator in the given script entryindicates that the given script entry is the first script entry for themodified data packet.
 20. The computer program product of claim 18,wherein the determines (b5) is configured to: (b5i) determine whether anend of packet (EOP) indicator in the given script entry indicates thatthe given script entry is the last script entry for the modified datapacket.
 21. The computer program product of claim 18, wherein thereserve (b3) and the copy (b4) are configured to: (b3i) set a packetbuffer marker at a beginning of the packet buffer; (b4i) append a copyof the data in the data block at the block location and with the blocklength identified in the given editing script to the packet buffer atthe packet buffer marker; and (b4ii) modify the packet buffer marker bythe block length identified in the given editing script.
 22. Thecomputer program product of claim 18, wherein the generate (c) isconfigured to: (c1) in response to determining that the given scriptentry is the last script entry for the modified data packet, generatethe modified data packet with the data in the packet buffer.
 23. Thecomputer program product of claim 22, wherein the generate (c) isfurther configured to: (c2) determine whether the given script entry isthe last script entry in the packet editing script; and (c3) in responseto determining that the given script entry is not the last script entryin the packet editing script, repeat the retrieve (b1), the determine(b2), the reserve (b3), the copy (b4), the determine (b5), the perform(b6), and the generate (c1) for a next given script entry in the packetediting script.
 24. The computer program product of claim 23, whereinthe determine (c2) is configured to: (c2i) determine whether an end oftable (EOT) indicator in the given script entry indicates that the givenscript entry is the last script entry in the packet editing script.